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The Independent System Health Management-Autonomous Control (ISHM-AC) application development for 
cryogenic delivery systems is intended to create an expert system that will require minimal operator 
involvement and ultimately allow for complete autonomy when fueling a space vehicle in the time prior to 
launch. The G2-Autonomous Control project is the development of a model, simulation, and ultimately a 
working application that will control and monitor the cryogenic fluid delivery to a rocket for testing 
purposes. To develop this application, the project is using the programming language/environment Gensym 
G2. The environment is an all-inclusive application that allows development, testing, modeling, and finally 
operation of the unique application through graphical and programmatic methods. We have learned G2 
through training classes and subsequent application development, and are now in the process of building the 
application that will soon be used to test on cryogenic loading equipment here at the Kennedy Space Center 
Cryogenics Test Laboratory (CTL). The G2 ISHM-AC application will bring with it a safer and more 
efficient propellant loading system for the future launches at Kennedy Space Center and eventually mobile 
launches from all over the world. 


I. Introduction 

G2 has been tasked with developing a potential command-and-control environment with which it is hoped future 
space vehicle launches will be able to be automatically fueled with minimal operator involvement. The aim is to 
have a sequencer application that will control the propellant delivery to the vehicle according to a predefined 
procedure. The team is responsible for understanding the environment and the programming language thoroughly 
enough to create a unique application that will simulate data, be able to display different marks for different 
transducers and physical phenomena, and ultimately be able to use that data to make the best decision if an anomaly 
is encountered. Along with the actual code for this logic comes the complex task of creating fault models and 
isolation subsystems which parse the schematics into segmented systems to better understand errors and 
inconsistencies during operation. These tasks can be generalized as root cause analyses and root-cause-trees. The 
other half of being able to accomplish our set goals is having intimate knowledge of fluid systems, and more 
specifically cryogenic fluid systems, in order to build the safest and best performing application possible. This report 
describes the support provided during this internship. 

II. Details 

This report will be chiefly concerned with the preparation of the current G2 ISHM-AC toolkit in the Cryogenic 
Test Laboratory for a demonstration that is slated for the end of July 2014. This includes my contribution in 
programming code that sets off-scale readings and other health determining factors for physical sensors; code that 
identifies those unhealthy sensors; and code that reasons about the data and system to find a replacement sensor in 
the flow path to continue operation, should it deem anomalies non-critical. Prior to demonstration, these capabilities 
will be tested using simulated fluid flow and replay data from past flows at the CTL. 


1 NASA USRP Summer Intern 2014, NE-C4, Kennedy Space Center, College of San Mateo. 
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A. Fluid Systems and the Mechanical Schematics 

A working knowledge of fluid piping systems and the physics involved in flowing fluid from a source to a 
vehicle were necessary in order to be able to program autonomous logic into the application. To gain this 
knowledge, the Kennedy Space Center library provided learning material and textbooks on fluid dynamics, 
cryogenic process engineering, and the nature of flow through different piping, valves, and pumps. The study of 
these concepts and their application was a vital part in understanding the project’s end goal of developing an 
accurate command and control application. 

After developing a general knowledge of fluid piping systems, understanding the physical system was necessary 
prior to software development. The system currently at the CTL is the Simulated Propellant Loading System 
(SPLS), which under its base configuration uses Allen Bradley PLCs (Programmable Logic Controllers) with a 
complementary application run from a control room to command valves when flowing fluid. Communication to the 
field hardware is facilitated by interfacing a Kepware OPC server with command and control software. 

Along with the physical structure of the mechanical system came the Concept of Operations (CONOPS). This 
document describes the sequence of events most likely to occur during the process of flowing fluid from the source 
to the model vehicle tank that is part of the SPLS. This is important in determining our own list of events for the 
sequencer we create for each test or demonstration. 

B. Gensym G2 

G2 is a proprietary environment that uses object oriented programming and visual programming methods to 
allow the developers to create unique applications in order to resolve their mission objectives. It is rule and logic 
driven, allowing it to reason about the different aspects of a design, in conjunction with incoming data, in order to 
make the application autonomous. 

The power of G2 is in its ability to provide reasoning around incoming physical data, simulation data, and hard- 
coded class attributes. Using this information, it provides autonomous decision making when anomalies occur, 
therefore providing safety, as well as efficiency, to the process. 


C. Development of Health Statuses for Physical Sensors 

The ability to determine the health of physical sensors is needed within an autonomous control system. Because 
sensors are the only way to determine what is happening in the field, their measurements and calibrations must be 
accurate enough to warrant decisions that the autonomous application makes. To determine health, off-scale 
violations were programmed to monitor, and then change an attribute within the class that indicates the sensor is not 
reading correctly. These off-scale readings use the difference between a stored number and the data that is coming 
from the transducer. This can be in terms of absolute readings, or raw electrical signal readings. Both may be used to 
determine the health of the sensor. 

When anomalies are detected that are not caused by unhealthy sensors but actual problems with the system, the 
application must decide if the problem can be fixed or if it should enter into a revert or abort procedure. Within the 
autonomous -engine code is the reasoning capability of the application to take readings upstream and downstream of 
the unhealthy sensor to check if other sensors’ readings are similar or different. This way, the system can decide if 
the anomaly is due to a faulty sensor or an actual event that requires a revert sequence. 
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D. Development of Program to Autonomously Choose the Best Alternative Sensor 

After determining that a sensor has become unhealthy, it is imperative that the application find a replacement 
sensor in the flow-path so that the sequencer is not interrupted. This advancement is intended to be the largest 
departure from old propellant loading procedures where a simple calibration mistake on a sensor could scrub a 
launch. 

The code that seeks the alternative sensor uses a method of separating the piping schematic within the 
application into smaller, more manageable pieces, called “piping sections”. This way, sensors can be grouped into 
specific sections, and if there is a sensor in a section that is unhealthy, then an alternative sensor can be found in the 
same section or in adjacent sections. Possible alternative sensors are indexed and checked for their own health 
before the best is chosen and inserted into the sequencer in place of the failed sensor. If a replacement sensor cannot 
be found, figures from simulations and other sensor data are taken into consideration for whether or not to continue 
operation or move into an abort procedure. 


E. Documentation 

Before the demonstration can occur documentation must be completed. The most important documents are the 
Requirements document, the Software Development Plan, and the Software Description. These documents will 
provide the main overview of the desired outcomes of the system, the functions of the system, and how they will be 
tested and implemented. The process of writing these documents entails going through the entire G2 ISHM-AC 
application so that every aspect can be described and explained. 


III. Results 

The team is planning a demonstration with flowing liquid nitrogen (LN2) at the end of luly 2014. If the 
documentation is not completed in time, there will be a dry run so the system can send commands to the valves to 
show its ability to control the field hardware. The main goal for this first demonstration is to show that the 
application can classify an unhealthy sensor and then replace it with a healthy one so that the sequencer’s valve 
commands proceed with minimal interruption. 


A. Final Product 

The mission for G2 is to have a command and control application that will include an automatic sequencer that 
has the ability to deliver cryogenic propellants to a vehicle with minimal human operation. In the near term we 
envision G2 possessing commanding abilities with the SPLS at the CTL so that testing with propellant on ground 
hardware can become the next goal of the project. 


B. Continuation 

Aside from the documentation effort, the team will focus on making the sequencer as stable as possible and the 
health checks of all field hardware accurate and reliable. Another large part of the team’s continued effort will be 
focused on creating and refining the fault models and root-cause trees that make the application’s decision making 
capabilities possible. 
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IV. Conclusion 

The autonomous control capability of the G2 ISHM-AC application will be an integral part of the way we 
conduct ground operations in the future of spaceflight. Less human operators and the application’s real-time 
decision making ability mean more efficient and safer launches. Perhaps with these innovations, spaceflight will 
become cheaper and more commonplace, thus allowing for exploration and commerce to be conducted on a more 
routine basis. 

Being able to support in the creation of a command and control system that will help to that end is rewarding and 
challenging. While attempting to apply the knowledge that I have brought with me to Kennedy Space Center, I also 
learned how to reason about things in an electronics environment that I don't believe I would have gotten anywhere 
else. The hands-on experience of helping this project is invaluable as I begin my career as a professional engineer. 

As my third semester here in NE-C4 at Kennedy Space Center comes to a close, I can very safely say that I could 
not have had a better experience. The work here is interesting and challenging, and most importantly there is always 
more of it. There are always people doing equally interesting and challenging things, and without having to get too 
involved, an engineer might be able to offer some help or insight that resolves the problem. That is a motivating type 
of workplace, one where 1 feel I have grown more than I ever expected, and have gained the experience to know 
what I want out of my career as a mechanical engineer. 
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Appendix of Acronyms 

CTL - Cryogenic Test Laboratory 
LCH4 - Liquid methane 
LCS - Launch Control System 

LCSDEV - Launch Control System Development Network 

LOX - Liquid Oxygen 

SSPF - Space Station Processing Facility 

SPLS - Simulated Propellant Loading System 

LCC - Launch Control Center 

OSBI - Operations Support Building 1 

SPLS - Simulated Propellant Loading System 

OSBII - Operations Support Building II 

UPSS - Universal Propellant Seiyicing System 
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